chmod Calculator

The Kordu chmod Calculator turns Linux and Unix file permission settings into an octal value, a symbolic string, and a ready-to-run chmod command. Toggle read (r), write (w), and execute (x) for the three permission classes — owner (user), group, and others — and instantly see the result in every format you need. Quick presets cover the permission values you use daily: 755 for web directories and scripts, 644 for regular files, 700 for private directories, 600 for SSH keys, 444 for read-only archives, and 777 when you absolutely need wide-open access in a sandbox.

The POSIX permission model

Every file and directory on a Linux, macOS, or other Unix-like system carries nine permission bits — three classes (user, group, others) multiplied by three actions (read, write, execute). These nine bits compress cleanly into three octal digits because each digit encodes exactly three bits. The order is always the same: user first, group second, others third. chmod 750 grants the owner full access (7 = rwx), the group read + execute (5 = r-x), and everyone else nothing (0 = ---).

Bit values are additive

• read (r) = 4 — list a directory's contents, open a file
• write (w) = 2 — create, rename, or delete entries in a directory, modify a file
• execute (x) = 1 — enter a directory (cd into it) or run a file as a program

Sum the values to build each digit. rwx is 4+2+1 = 7. r-x is 4+0+1 = 5. rw- is 4+2+0 = 6. Once the pattern clicks, reading chmod 640 as "owner rw, group r, others nothing" becomes second nature.

Common recipes you'll reach for

• 755 (rwxr-xr-x) — web server directories, CLI scripts, anything the world should read and execute but not modify.
• 644 (rw-r--r--) — regular web files (HTML, CSS, images), config files, most plain-text files. Execute isn't needed unless the file is a script.
• 700 (rwx------) — private directories only the owner may enter.
• 600 (rw-------) — private keys, tokens, .env files, ~/.ssh/id_rsa. OpenSSH refuses to use a key that is group- or world-readable.
• 444 (r--r--r--) — immutable read-only archives or reference files.
• 777 (rwxrwxrwx) — full access for everyone. Almost always the wrong answer in production; it's the permission equivalent of "I don't know what the problem is, so I'm going to solve it with a sledgehammer."

Symbolic notation and symbolic chmod

The string rwxr-xr-x is the same permissions as octal 755, written out bit-by-bit. You'll see it everywhere ls -l runs. chmod also accepts symbolic operands directly: chmod u+x script.sh adds execute for the owner, chmod go-w file removes write for group and others, chmod a=r file sets everyone to read-only. The operator classes are u (user/owner), g (group), o (others), and a (all). Operators are + (add), - (remove), and = (set exactly). Symbolic mode is ideal when you want to flip one bit without recalculating the whole value; octal is faster when you know the exact target.

Execute on directories vs. files

For files, execute means "run this as a program." For directories, it means "traverse" — you can cd into the directory and access entries by name. Crucially, you can have read without execute on a directory (you can ls it but cannot cd into it or open files inside), or execute without read (you can open a specific file by path but cannot list the directory). Most workflows want both, which is why 755 and 750 are so common.

Special bits — setuid, setgid, sticky

A fourth octal digit, prepended, encodes three special modes. setuid on an executable (chmod u+s or a leading 4) runs it as the file's owner regardless of who launched it — this is how /usr/bin/passwd edits /etc/shadow. setgid on a directory (chmod g+s or leading 2) forces new files inside to inherit the directory's group, handy for shared team folders. The sticky bit (chmod +t or leading 1) on a directory restricts deletion so only the file's owner (or root) may remove entries — this is why /tmp is chmod 1777.

Recursive changes — split files and directories

chmod -R 755 ./site applies 755 to every entry, files included — which grants execute to every file even when it isn't needed. The canonical fix is to split by type: find . -type d -exec chmod 755 {} \; for directories and find . -type f -exec chmod 644 {} \; for files. You get the right execute bit on directories without flipping it on every stylesheet.

umask — the mask for newly created files

When a process creates a file, the kernel starts from 666 (files) or 777 (directories) and subtracts the umask. A umask of 022 yields 644 for files and 755 for directories — the default on most distributions. A umask of 002 (common in shared-group setups) yields 664 and 775. Set it in ~/.bashrc, ~/.zshrc, or /etc/profile to control defaults for a shell session. umask does not affect chmod itself; it only changes what new files start out as.

SSH key requirements

OpenSSH is strict: ~/.ssh should be 700, private keys 600, and authorized_keys 600. Looser permissions cause Permissions are too open errors and a refused connection. chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_rsa fixes the common case after copying keys between machines.

Deploy recipes that actually work

Web servers typically run as www-data, nginx, or apache. Set ownership with chown -R www-data:www-data /var/www/site, then apply 755 to directories and 644 to files using the find split above. Lock down secrets: chmod 600 .env. Grant the web user write only where uploads land: chmod 775 on upload dirs with a group the web user belongs to.

ACLs, SELinux, and when chmod isn't enough

POSIX ACLs (setfacl, getfacl) extend the model with per-user and per-group grants beyond the three-class scheme — useful when two specific users need different access to the same file. SELinux and AppArmor sit above chmod as mandatory access control policies; a process denied by SELinux will fail even with chmod 777. On Windows, NTFS uses ACLs via icacls, and WSL surfaces a best-effort mapping that can produce surprising permission drift — if a file looks like 777 on Windows but 644 in WSL, the mount options are the culprit.

Common mistakes

• Using chmod 777 as a "fix." It masks the real permission mismatch and opens a security hole.
• Forgetting -R on a tree, or using -R and ruining directory traversal or file execute bits. Split by -type instead.
• Expecting git to preserve arbitrary permissions. Git only tracks the executable bit (mode 755 vs 644). Permissions must be re-applied after clone — usually via a deploy script.
• Making .env or a private key world-readable. Set them to 600 at creation time, not as an afterthought.

Privacy

Every calculation happens in your browser. Nothing is uploaded, logged, or transmitted. The tool is pure client-side JavaScript — it works offline once the page has loaded and has no signup, rate limits, or backend.